Accessing appsync via lambda produces unauthorized even with proper role - node.js

Question

I'm trying to call appsync from a lambda function that I set up using aws amplify. I can tell that my lambda function has read/write permission for appsync, but when I make the POST request from lambda to appsync, I get a Unable to parse JWT token error. The weird thing is that when I look at the header, I don't see the authorization jwt that I see when I am requesting from the web application, so that could be why I'm seeing this error. Instead, I see an x-amz-security-token and a different type of authorization string that you can see in the image below.
My code is pulled from a blog I found from Adrian Hall:
const env = require('process').env
const fetch = require('node-fetch')
const URL = require('url')
const AWS = require('aws-sdk')
AWS.config.update({
region: env.AWS_REGION,
credentials: new AWS.Credentials(
env.AWS_ACCESS_KEY_ID,
env.AWS_SECRET_ACCESS_KEY,
env.AWS_SESSION_TOKEN
),
})
exports.handler = (event, context, callback) => {
const ListCourses = `query ListCourses(
$filter: ModelTodoFilterInput
$limit: Int
$nextToken: String
) {
listCourses(filter: $filter, limit: $limit, nextToken: $nextToken) {
items {
id
}
nextToken
}
}`
// const details = {
// userId: event.request.userAttributes.sub,
// userDetails: {
// name: event.request.userAttributes.name,
// },
// }
const post_body = {
query: ListCourses,
operationName: 'ListCourses',
variables: details,
}
console.log(env)
console.log(`Posting: ${JSON.stringify(post_body, null, 2)}`)
// POST the GraphQL mutation to AWS AppSync using a signed connection
const uri = URL.parse(env.API_GRAPHQLAPIENDPOINTOUTPUT)
const httpRequest = new AWS.HttpRequest(uri.href, env.REGION)
httpRequest.headers.host = uri.host
httpRequest.headers['Content-Type'] = 'application/json'
httpRequest.method = 'POST'
httpRequest.body = JSON.stringify(post_body)
AWS.config.credentials.get(err => {
const signer = new AWS.Signers.V4(httpRequest, 'appsync', true)
signer.addAuthorization(AWS.config.credentials, AWS.util.date.getDate())
const options = {
method: httpRequest.method,
body: httpRequest.body,
headers: httpRequest.headers,
}
console.log('here is the uri and options')
console.log(uri.href)
console.log(options)
fetch(uri.href, options)
.then(res => res.json())
.then(json => {
console.log(`JSON Response = ${JSON.stringify(json, null, 2)}`)
callback(null, event)
})
.catch(err => {
console.error(`FETCH ERROR: ${JSON.stringify(err, null, 2)}`)
callback(err)
})
})
}
Does anyone know why the credentials methods are authorizing the way that they are and how I can fix this UnauthorizedException error? Just to sanity check me, in amplify, I did select that I wanted this lambda function to have read/write access and I can see in the CF template that:
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"appsync:Create*",
"appsync:StartSchemaCreation",
"appsync:GraphQL",
"appsync:Get*",
"appsync:List*"
],
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:appsync:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":apis/",
{
"Ref": "apiGraphQLAPIIdOutput"
},
"/*"
]
]
}
]
}
]
}

Answer 1

You would have to use AWS_IAM as the authorization mode for your API if you want to call it from the lambda. Based on the error, it seems your API is setup to use AMAZON_COGNITO_USER_POOLS as the authorization. If you want to mix the 2 in your API, you might want to look at the following blog:
https://aws.amazon.com/blogs/mobile/using-multiple-authorization-types-with-aws-appsync-graphql-apis/